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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )£3 Responsive to communication(s) filed on 20 July 2007 . 
2a)0 This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) £3 Claim(s) 1-18 is/are pending in the application. 

4a) Of the above claim(s) 19-32 is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed; 

6) IEl Claim(s) 1-13 and 15-18 is/are rejected. 

7) ^ Claim(s) 14 is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 
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Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
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DETAILED ACTION 



Response to Amendment 
This office action is in response to amendment filed on July 30, 2007. Presently pending 
claims are 1-18. 



Response to Arguments 



Applicant's arguments with respect to claims 1-18 filed on November 27, 2006 have been 
considered but are moot in view of the new ground(s) of rejection. 

Allowable Subject Matter 
Claim 14 objected to as being dependent upon a rejected base claim, but would be 
allowable if rewritten in independent form including all of the limitations of the base claim and 
any intervening claims. 
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Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

1. Claims 1-13, and 15-18 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Johnson et al (U. S. Patent 5,964,839) and further in view of Togawa (U. S. Patent 6,240,530). 

2. With respect to claim 1, Johnson teaches a system for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, the system 
including computer software fro running on the computer system (col. 2 line 44 to col.31ine 66), 
the system comprising: 

observer data that includes data descriptive of an observer program, the observer program being 
programmed to observe a user's activities on the computer system by monitoring user input 
entered through a user input device and also operating to create log file from the observing of the 
observer program; and accessing instructions that access the observer data, generating 
instructions that generate results from the comparing, wherein the results generated indicate 
whether the observer program is present on the computer system; and outputting instructions that 
obtain the results and provide the results for a user (col. 12 line 51 to col. 14 line 15). 
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Although the system disclosed by Johnson shows all the features of the claimed limitation, but 
Johnson does not specifically disclose comparing instructions that compare the observer data 
with memory data read in from memory. 

In an analogous art, Togawa, on the other hand discloses computing environment that 
relates to method and apparatus for providing reading instructions that read memory of the 
computer system to obtain memory data, comparing instructions that compare the observer data 
with memory data read in from memory to determine whether the observer program is present on 
the computer system (col. 8 line 10 to col.l 1 line 28, and col. 19 line 16 to col. 20 line 10). 
Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa's method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
against attempt by unauthorized person to breach security of system (Togawa,col.5 line 7 to line 
38) 

3. Claim 2 is rejected as above in rejecting claim 1, wherein the reading instructions read 
the memory of the computer system by querying the operating system of the computer system 
for the tasks running and by examining task information provided by the operating system 
[col. 13 line 55 to line 65). 

4. Claim 3 is rejected as above in rejecting claim 1, wherein the outputting instructions 
provide the results to a user through a graphical user interface (col. 8 line 21 to line 35). 
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5. Claim 4 is rejected as above in rejecting claim 1 , wherein the reading instructions read 
the memory of the computer system by querying the file system of the computer system for the 
files located on storage media and by examining file information provided by the file system 
(Togawa: col. 19 line 10 to col. 20 line 65). 

6. Claim 5 is rejected as above in rejecting claim 1, wherein the reading instructions read 
the memory of the computer system by opening a file located on storage media and by 
examining contents of the file (Togawa: col. 19 line 10 to col. 20 line 65). 

7. Claim 6 is rejected as above in rejecting claim 1 , wherein the observer data includes data 
descriptive of a plurality of observer programs and wherein the system compares the observer 
data with the memory data to determine whether any known observer program is present 
(Togawa: col. 19 line 10 to col.20 line 65). 

8. Claim 7 is rejected as above in rejecting claim 1, further comprising countermeasure 
instructions wherein the countermeasure instructions alter the operation of the observer program 
(Togawa: col. 1 9 line 1 0 to col.20 line 65). 

9. Claim 8 is rejected as above in rejecting claim 7, wherein the countermeasure instructions 
alter the operation of the observer program by altering observer program configuration data 
(Togawa: col. 19 line 10 to col.20 line 65). 

10. Claim 9 is rejected as above in rejecting claim 7, wherein the countermeasure instructions 
alter the operation of the observer program by altering a file on the computer system (Togawa: 
col.5 line 7 to line 39, col.l31ine 8 to line 56, and col. 19 line 10 to col.20 line 65). 

1 1 . Claim 10 is rejected as above in rejecting claim 7, wherein the countermeasure 
instructions alter the operation of the observer program by altering reporting data generated by 
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the observer program (Togawa: col. 5 line 7 to line 39, col. 13 line 8 to line 56, and col. 19 line 10 
to col. 20 line 65). 

12. Claim 1 1 is rejected as above in rejecting claim 7, wherein the countermeasure 
instructions alter the operation of the observer program by replacing reporting data generated by 
the observer program (Togawa: col. 5 line 7 to line 39, col.l31ine 8 to line 56, and col. 19 line 10 
to col.20 line 65). 

13. Claim 12 is rejected as above in rejecting claim 7, wherein the countermeasure 
instructions alter the operation of the observer program by replacing a file of the observer 
program (Togawa: col. 5 line 7 to line 39, col.l31ine 8 to line 56, and col. 19 line 10 to col.20 line 
65). 

14. Claim 13 is rejected as above in rejecting claim 1, wherein the observer data includes 
data descriptive of observing activity typical of observing programs and wherein the system 
compares the observer data with the memory data to determine whether any known observer 
program is present (Johnson: (col. 12 line 51 to col. 14 line 15, and Togawa: col. 5 line 7 to line 
39, col.l31ine 8 to line 56, and col.19 line 10 to col.20 line 65). 

15. Claim 15 is rejected as above in rejecting claim 1, wherein the system is made available 
over a computer network through a web site (Johnson: Fig.l col.41ine 30 to col. 5 line 38). 

16. With respect to claim 16, Johnson teaches a system for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, the system 
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including computer software fro running on the computer system (col. 2 line 44 to coL31ine 66), 
the system, comprising: 

observer data that includes data descriptive of an observer program, the observer program being 
programmed to observe a user's activities on the computer system by monitoring user input 
entered through a user input device and also operating to create log file from the observing of the 
observer program; and means for accessing the observer data; means for generating results from 
the comparison, wherein the results generated indicate whether the observer program is present 
on the computer system; and means for outputting the results for a user (col. 12 line 51 to col. 14 
line 15). 

Although the system disclosed by Johnson shows all the features of the claimed limitation, but 
Johnson does not specifically disclose comparing instructions that compare the observer data 
with memory data read in from memory. 

In an analogous art, Togawa, on the other hand discloses computing environment that 
relates to method and apparatus for providing means for reading memory of the computer system 
to obtain memory data, means for comparing the observer data with memory data to determine 
whether the observer program is present on the computer system (col.8 line 10 to col.l 1 line 28, 
and col. 19 line 16 to col.20 line 10). 

Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa' s method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
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against attempt by unauthorized person to breach security of system (Toga wa, col. 5 line 7 to line 
38) 

1 7. With respect to claim 1 7, Johnson teaches a method for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, the system 
including computer software fro running on the computer system (col. 2 line 44 to col.31ine 66), 
the method comprising the steps of: 

accessing observer data, the observer data including data descriptive of an observer program, the 
observer program being programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and also operating to create log file 
from the observing of the observer program; generating results from the reading and comparing, 
wherein the results generated indicate whether the observer program is present on the computer 
system; and outputting the results for a user (col. 12 line 51 to col. 14 line 15). 
Although the system disclosed by Johnson shows all the features of the claimed limitation, but 
Johnson does not specifically disclose comparing instructions that compare the observer data 

i 

with memory data read in from memory. 

In an analogous art, Togawa, on the other hand discloses computing environment that 
relates to method and apparatus for providing reading memory of the computer system to obtain 
memory data; comparing the observer data with memory data read in from memory to determine 
whether the observer program is present on the computer system (col. 8 line 10 to col. 1 1 line 28, 
and col. 19 line 16 to col. 20 line 10). 
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Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa's method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
against attempt by unauthorized person to breach security of system (Togawa,col.5 line 7 to line 
38) 

18. With respect to claim 18, Johnson teaches a computer-readable medium containing 
instructions for detecting the presence of an observing program on a computer system, wherein 
the observing program is programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and to create data from the observing 
on the computer system, wherein the instructions are executable to (col. 2 line 44. to col.31ine 66) 
comprised of the steps of: 

access observer data, the observer data including data descriptive of an observer program, the 
observer program being programmed to observe a user f s activities on the computer system by 
monitoring user input entered through a user input device and also operating to create log file 
from the observing of the observer program; generate results from the reading and comparing, 
wherein the results generated indicate whether the observer program is present on the computer 
system; and output the results for a user (col. 12 line 51 to col. 14 line 15). 
Although the system disclosed by Johnson shows all the features of the claimed limitation, but 
Johnson does not specifically disclose comparing instructions that compare the observer data 
with memory data read in from memory. 
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In an analogous art, Togawa, on the other hand discloses computing environment that 
relates to method and apparatus for providing; read memory of the computer system to obtain 
memory data; compare the observer data with memory data read in from memory to determine 
whether the observer program is present on the computer system;(col.8 line 10 to col.l 1 line 28, 
and col. 19 line 16 to col.20 line 10). 

Therefore, It would have been obvious to one ordinary skilled in the art at the time of invention 
to combine the teachings of Johnson and Togawa, because Togawa' s method of detection and 
removal of computer spyware (malware) by using detection and selection mechanism would not 
only promote security structure in the system of Johnson during monitoring information and data 
collection, such as keylogging, of host computing devices but will also provide safeguards 
against attempt by unauthorized person to breach security of system (Togawa, col. 5 line 7 to line 
38). 



Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Syed Zia whose telephone number is 571-272-3798. The 
examiner can normally be reached on 9:00 to 5:00. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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